How does Darktrace / NETWORK receive the traffic it analyses?

Correct: a. It is out-of-band: a SPAN/mirror port or TAP feeds it a copy of traffic, so it adds no latency and cannot break the live network.

What does 'pattern of life' refer to?

Correct: b. Self-Learning AI continuously builds a baseline of normal behaviour per entity; detections are deviations from that learned pattern of life.

You need to see threats moving between internal hosts (east-west), not just at the perimeter. Why does NDR suit this?

Correct: d. NDR observes behaviour network-wide, so lateral movement between internal hosts shows up as anomalous — something perimeter-only, signature tools routinely miss.

Why can Darktrace flag suspicious activity inside encrypted traffic without decrypting it?

Correct: c. The behaviour is abnormal even when the payload is unreadable, so connection patterns, volumes, timing and destination rarity reveal threats like beaconing without any decryption.

Compared with an inline IPS, what is the strongest advantage of passive NDR?

Correct: b. Out-of-band means zero added latency and no risk of dropping legitimate traffic, while behavioural analysis catches unknown threats an inline, signature-based IPS would miss.

An interviewer asks where Darktrace detections go next. Best answer?

Correct: d. Detections feed Cyber AI Analyst, which investigates and narrates the incident, and Autonomous Response (formerly Antigena), which can take surgical containing action.

Darktrace / NETWORK — AI Network Detection & Response, Deployed Passively (2026)

Q: Why can Darktrace / NETWORK catch a brand-new attack that has no signature?

Correct: c. Darktrace learns your environment's normal behaviour rather than matching known-bad signatures. A novel attack still behaves abnormally, so it stands out as a deviation — no signature required.

Q: How is Darktrace / NETWORK deployed on the network?

Correct: b. It is out-of-band: it ingests a copy of traffic from a SPAN/mirror port or a network TAP, so it adds no inline latency and cannot drop or break legitimate traffic.

Q: A host is making rare, regularly-timed connections to an unknown external server over HTTPS. What can Darktrace do?

Correct: c. Darktrace reads metadata and behaviour — timing, volume, rarity of the destination — so it can flag C2-style beaconing inside encrypted flows without breaking TLS or sharing keys.

Q: A device shows external beaconing but Darktrace never flagged its internal scanning. What is the most likely cause?

Correct: a. Passive means Darktrace only sees what is fed to it. If the SPAN/mirror or TAP doesn't include that VLAN's east-west traffic, the internal lateral movement is simply invisible — add the segment to the feed (or a cSensor).

Most engineers think…

Most people assume any network security tool must sit inline and match a database of known-bad signatures — like an IPS or antivirus. That model is exactly what Darktrace / NETWORK is not.

Darktrace / NETWORK is an AI Network Detection & Response (NDR) product. It sits passively, out-of-band on a copy of your traffic (a SPAN/mirror port or a TAP), so it adds no latency and can never break a connection. Instead of signatures, its Self-Learning AI learns the normal 'pattern of life' for every device and user, then flags deviations — which is how it catches the novel, unknown threats a signature has never seen, including activity hiding inside encrypted traffic.

① What NDR is — and why behaviour beats signatures

The core idea: Darktrace / NETWORK is an NDR — Network Detection & Response — that watches your whole network and uses Self-Learning AI to build a behavioural baseline, a pattern of life, for every device and user. New behaviour is scored against that learned normal; a strong deviation is what raises a detection.

Contrast this with a signature tool. A signature can only match an attack that someone has already seen, named and described. A novel or unknown attack has no signature, so signature-only tools are blind to it. Because Darktrace learns your normal instead, a never-before-seen technique still stands out the moment it behaves abnormally.

Darktrace / NETWORK is also the product that brings together what used to be the separate network DETECT and Antigena (response) capabilities — one Self-Learning AI engine for detection and response across the network.

Figure 1 — How Self-Learning AI raises a detection

Darktrace learns each entity's normal, then scores new behaviour against it — a strong deviation becomes a detection.

Say 'behaviour, not signatures'

In an interview, lead with the one-liner: Darktrace learns a 'pattern of life' for every device and user, then flags deviations. That is why it catches novel, unknown threats a signature tool — which only knows what it has already seen — will miss.

Quick check · Q1 of 10 · Understand

Why can Darktrace / NETWORK catch a brand-new attack that has no signature?

a) It downloads a fresh signature firstb) It blocks everything by defaultc) Self-Learning AI flags it as a deviation from the learned 'pattern of life'd) It only works on known malware

Correct: c. Darktrace learns your environment's normal behaviour rather than matching known-bad signatures. A novel attack still behaves abnormally, so it stands out as a deviation — no signature required.

👉 So far: Darktrace / NETWORK is an AI NDR: Self-Learning AI builds a 'pattern of life' per device and user, and flags deviations — so it catches novel threats signatures can't describe.

② Passive deployment — a copy of traffic, no latency

Here is the deployment fact that surprises people: Darktrace / NETWORK is passive and out-of-band. It does not sit in the traffic path. Instead it ingests a copy of traffic from a switch SPAN/mirror port or a hardware network TAP.

Two consequences matter in an interview. First, it adds zero inline latency — the production traffic never waits on Darktrace. Second, it cannot drop or break legitimate traffic, because it only ever sees a copy. That is the key contrast with an inline IPS or firewall, which sits in the path: powerful, but a potential source of latency and a single point of failure.

The catch you must remember

Passive means Darktrace only sees what is fed to it. If a SPAN session or TAP is not configured for a given VLAN or segment, that traffic is simply invisible to Darktrace — a very common cause of 'why didn't it alert?' gaps, especially for internal east-west traffic.

Figure 2 — Passive NDR vs inline IPS

NDR sees a copy of traffic and can't break it; an inline IPS sits in the path and matches known signatures.

🧠

Self-Learning AI

tap to flip

Learns each environment's normal from its own traffic — no pre-loaded signatures. The engine behind every detection.

📈

Pattern of life

tap to flip

The continuously-updated behavioural baseline per device and user. Anomalies are deviations from it, which is how novel threats surface.

🔌

Passive / out-of-band

tap to flip

Runs on a copy of traffic from a SPAN/mirror port or TAP — zero inline latency and physically unable to break live traffic.

🕵️

Cyber AI Analyst

tap to flip

Automatically investigates and correlates detections into a single human-readable incident narrative, so triage takes minutes.

'It's just another inline IPS' is wrong

Darktrace / NETWORK is passive and out-of-band — it runs on a copy of traffic and cannot break a connection or add latency. Calling it an inline appliance gets the deployment model, the latency story and the failure mode all wrong.

Quick check · Q2 of 10 · Remember

How is Darktrace / NETWORK deployed on the network?

a) Inline, in the traffic path like a firewallb) Passively / out-of-band on a copy of traffic from a SPAN/mirror or TAPc) As a cloud-only API with no traffic visibilityd) Only as an endpoint antivirus agent

Correct: b. It is out-of-band: it ingests a copy of traffic from a SPAN/mirror port or a network TAP, so it adds no inline latency and cannot drop or break legitimate traffic.

👉 So far: It deploys passively / out-of-band on a copy of traffic (SPAN/mirror or TAP): zero inline latency, can't break traffic — but it only sees what is fed to it.

③ What it detects — including inside encrypted traffic

Because it reasons about behaviour, Darktrace / NETWORK catches the stages of an attack that signatures miss: C2 beaconing (regular, often low-and-slow callbacks to a rare external host), lateral movement (internal scanning, unusual SMB/RDP between hosts), data exfiltration (abnormal outbound transfers), anomalous credential use, network scanning/reconnaissance, and the early stages of ransomware before mass encryption.

It watches east-west (internal) traffic, not just the north-south perimeter — so an attacker who is already inside still gets seen.

Encrypted traffic without decryption

You do not need to break TLS. Darktrace analyses metadata and behaviour — who talks to whom, how often, volumes, timing, and how rare a destination is — so it can flag suspicious activity inside encrypted flows without decrypting them or sharing keys. The behaviour is abnormal even when the payload is unreadable.

Figure 3 — What Darktrace / NETWORK detects

Behavioural detection spans the attack lifecycle, even inside encrypted flows.

Prove visibility before you trust silence

No alerts is not the same as no threats. Before concluding a segment is clean, confirm Darktrace actually receives that VLAN's traffic — check the device's connection data in the Threat Visualizer and the SPAN/TAP sources on the switch. Passive tools are blind to what isn't fed to them.

▶ Watch Darktrace spot C2 + lateral movement from a passive copy

How an endpoint's quiet beaconing and internal scanning become a detection. Press Play for the healthy path, then Break it to see the classic blind spot.

① MirrorA switch SPAN port sends Darktrace a copy of the endpoint's traffic — Darktrace is out-of-band and changes nothing on the wire.

▼

② LearnSelf-Learning AI has already built this device's pattern of life: which hosts it normally talks to, how often, and how much.

▼

③ DeviateThe endpoint starts low-and-slow beaconing to a rare external host and scans internal SMB shares — well outside its normal behaviour.

▼

④ Detect + investigateThe deviation is flagged as likely C2 plus lateral movement and handed to Cyber AI Analyst, which stitches it into one incident.

Press Play to step through the healthy detection path. Then press Break it.

Quick check · Q3 of 10 · Apply

A host is making rare, regularly-timed connections to an unknown external server over HTTPS. What can Darktrace do?

a) Nothing, because the traffic is encryptedb) Force TLS decryption before it can see anythingc) Flag the abnormal beaconing behaviour from metadata, without decryptingd) Only catch it if a signature exists

Correct: c. Darktrace reads metadata and behaviour — timing, volume, rarity of the destination — so it can flag C2-style beaconing inside encrypted flows without breaking TLS or sharing keys.

👉 So far: It detects C2 beaconing, lateral movement, exfiltration and early ransomware — including inside encrypted flows, which it reads via metadata and behaviour without decrypting.

④ Coverage and where detections go next

Visibility spans on-prem, virtualised and cloud. Where there is no physical SPAN port to tap — cloud and virtual networks — coverage is extended by cloud sensors (cSensors), and individual machines can be covered by host-based sensors (osSensors). All of them feed the same Self-Learning AI analytics.

From detection to response

A detection is not the end of the line. It feeds Cyber AI Analyst, which automatically investigates, correlates related events, and writes an incident narrative so a human triages in minutes instead of hours. Detections also feed Autonomous Response (formerly Antigena), which can take a surgical, proportionate containing action.

The interview line: Darktrace detects from a passive copy of traffic, investigates with AI, and only then responds — that response layer is the subject of the next lesson.

Figure 4 — One AI engine, every vantage point

SPAN/TAP, cloud sensors and host sensors all feed the same Self-Learning AI, which drives investigation and response.

Figure 5 — From passive tap to contained incident

Detections from a passive copy of traffic are investigated by Cyber AI Analyst, then handed to Autonomous Response.

Priya at Meridian Logistics (Hyderabad) faces this

A finance laptop has quietly made rare, regularly-timed connections to an unfamiliar external host and poked at internal file-shares for weeks — yet no Darktrace alert fired.

Likely cause

Darktrace was tapped into the data-centre north-south traffic via one SPAN session, but the user VLAN's east-west traffic was never mirrored, so the lateral movement and internal scanning never reached it.

Diagnosis

In the Threat Visualizer the device shows external beaconing breaches but no internal connection data for that subnet; on the switch, the SPAN session's source ports don't include the user VLAN.

Threat Visualizer ▸ device ▸ Connections + switch ▸ monitor/SPAN session sources

Fix

Add the user VLAN(s) to the SPAN/mirror session (or add a TAP or a cSensor for that segment) so Darktrace sees east-west traffic, then let the pattern of life rebuild for those devices.

Verify

Re-check the device: internal SMB/RDP connections now appear, the lateral-movement and scanning models breach, and Cyber AI Analyst stitches the beaconing and lateral movement into a single C2 incident.

Quick check · Q4 of 10 · Analyze

A device shows external beaconing but Darktrace never flagged its internal scanning. What is the most likely cause?

a) The user VLAN's east-west traffic was never mirrored to Darktraceb) Darktrace decrypted the wrong trafficc) Signatures were out of dated) The firewall blocked Darktrace

Correct: a. Passive means Darktrace only sees what is fed to it. If the SPAN/mirror or TAP doesn't include that VLAN's east-west traffic, the internal lateral movement is simply invisible — add the segment to the feed (or a cSensor).

👉 So far: Coverage spans on-prem, virtual and cloud via cSensors and osSensors; detections feed Cyber AI Analyst for investigation and Autonomous Response for containment.

🤖 Ask the AI Tutor

Tap any question — instant, scoped to this lesson. No login, no waiting.

Pre-curated from vendor docs + community Q&A, scoped to this lesson. For a live prod issue, paste your export into chat.techclick.in.

🧠 In your own words

Type one line: why is Darktrace / NETWORK called a passive, behavioural NDR rather than an inline signature tool? Then compare with the expert version.

Expert version: Because it sits out-of-band on a copy of traffic (a SPAN/mirror port or TAP), so it adds no latency and can't break anything — unlike an inline IPS in the path. And instead of matching known-bad signatures, its Self-Learning AI learns each device and user's normal 'pattern of life' and flags deviations, which is how it catches novel, unknown threats — C2 beaconing, lateral movement, exfiltration, early ransomware — across east-west and north-south traffic, even inside encrypted flows it never decrypts. Detection then feeds Cyber AI Analyst and Autonomous Response.

🗣 Teach a friend

Best way to lock it in — explain it in one line to a teammate. Tap to generate a paste-ready summary.

📩 Quiz me on this in 7 days. Opt in and we'll email 3 micro-questions on Darktrace at Day 1, Day 7 and Day 30 — spaced repetition is how this sticks. Un-tick any time.

📖 Glossary

NDR (Network Detection & Response): Behavioural, network-wide threat detection and response that watches east-west and north-south traffic, not just the perimeter.
Self-Learning AI: Darktrace's engine that learns each environment's normal behaviour from its own traffic, with no pre-loaded signatures or rules.
Pattern of life: The continuously-updated behavioural baseline Darktrace builds per device and user; detections are deviations from it.
Passive / out-of-band: Deployment on a copy of traffic (SPAN/mirror or TAP) — adds no inline latency and physically cannot break live traffic.
SPAN / mirror port: A switch feature that copies traffic from chosen ports or VLANs to a monitoring port for a tool to inspect.
Network TAP: A passive hardware device on a link that copies its traffic for monitoring, with no effect on the live flow.
C2 beaconing: Regular, often low-and-slow callbacks from a compromised host to an attacker's command-and-control server.
cSensor / osSensor: Darktrace's cloud sensors and host-based (OS) sensors that extend visibility beyond physical SPAN/TAP points.
Cyber AI Analyst: Darktrace's automated investigation layer that correlates detections and produces a human-readable incident narrative.
Autonomous Response: Darktrace's surgical containment capability, formerly Antigena — the subject of the next lesson.

📚 Sources

Darktrace — Darktrace / NETWORK: Network Detection & Response product page. darktrace.com
Darktrace — Self-Learning AI and the 'pattern of life' explained. darktrace.com
Darktrace — Deployment: passive traffic ingestion via SPAN/mirror and TAP, cSensors and osSensors. darktrace.com
Darktrace — Detecting threats in encrypted traffic without decryption. darktrace.com
Darktrace — Cyber AI Analyst: automated investigation and incident narratives. darktrace.com
Industry overview — NDR vs IDS/IPS: behavioural and passive vs signature-based and inline.

What's next?

You've seen how Darktrace detects. Next: Autonomous Response (formerly Antigena) — how Darktrace takes surgical, proportionate action to contain a live threat without taking down the business, and how that 'human-in-the-loop vs autonomous' choice actually works.

Next · All interview lessons → Practice on exam.techclick.in →

Darktrace / NETWORK — AI NDR That Learns Normal and Breaks Nothing

🎯 By the end you will be able to

Pick where you want to start

What NDR is

Passive deployment

What it detects

Coverage & response

① What NDR is — and why behaviour beats signatures

② Passive deployment — a copy of traffic, no latency

The catch you must remember

③ What it detects — including inside encrypted traffic

Encrypted traffic without decryption

▶ Watch Darktrace spot C2 + lateral movement from a passive copy

④ Coverage and where detections go next

From detection to response

🤖 Ask the AI Tutor

📝 Wrap-up assessment — six more

🧠 In your own words

🗣 Teach a friend

📖 Glossary

📚 Sources

What's next?